Terms of Service

NISTnow is a self-guided cybersecurity assessment. You answer questions about how your business works today, and NISTnow maps your answers to the NIST Cybersecurity Framework 2.0 and turns them into a report: where you stand, what stands out, and a prioritized list of practical next steps.

NISTnow is built for the time before a business commissions its first full, formal assessment. The self-guided assessment here is an affordable on-ramp to that assessment, not a replacement for it. Two scopes are offered: NISTquick, which covers 44 controls, and the full NIST CSF 2.0 scope, which covers all 106 controls across the six functions of the framework.

We may change, add to, or withdraw features over time. We aim to keep the service available, but we do not promise uninterrupted access.

The report reflects what you told us. NISTnow does not inspect your systems, scan your network, test your controls, or verify your answers in any way. If an answer is inaccurate, incomplete, or optimistic, the report will be too. You are responsible for the accuracy of your answers and for deciding what to do about the results.

NIST does not endorse, review, or certify NISTnow. The NIST Cybersecurity Framework 2.0 is a voluntary framework published by the U.S. government, and NISTnow is an independent tool that references it.

Treat the report as a starting point for a conversation, not as a finding. Before you rely on it for anything consequential, such as a contract, an insurance application, a regulatory filing, or a customer questionnaire, get advice from a qualified professional.

NISTnow is a business tool. You may use it only for business purposes, and only if you are at least 18 years old and able to enter into a binding agreement. If you are using NISTnow on behalf of a business, you confirm that you are authorized to accept these terms for that business.

NISTnow is not intended for personal, household, or consumer use.

You need an account to run an assessment. You must give an email address you control, verify it, and keep your account details accurate. One person, one account: do not share your login with anyone else. If someone else needs access to your organization’s assessments, invite them as a member instead.

You are responsible for keeping your password confidential and for everything that happens under your account. Choose a strong password that you do not use anywhere else. We store passwords only as an Argon2id hash, never in a form we could read. If you think someone else has your password, change it right away from your account settings. Changing your password signs out every other session.

Sessions expire after a period of inactivity and in all cases within 30 days, so you will be asked to sign in again from time to time. We may suspend or disable an account that we believe is being used in breach of these terms, is compromised, or is putting the service or other users at risk.

NISTnow is pay per assessment. There is no subscription and no recurring charge. A NISTquick assessment is $250. A full NIST CSF 2.0 assessment is $500 for an organization account’s first full assessment and $750 for each full assessment after that. All prices are one time, in U.S. dollars. Prices do not include sales tax. Where sales tax applies, it is calculated and added at checkout, and the total is shown before you pay.

The first-full price is counted per organization account. While an organization account has a full report unlocked on one assessment, each further full assessment for that organization account is priced at the later price.

A NISTquick assessment can be upgraded to a full assessment. If its NISTquick report is already paid for, the upgrade costs the difference: $250 toward an organization account’s first full assessment, or $500 toward a later one. The NISTquick report stays available, and its answers can no longer be changed. Before the NISTquick report is paid for, switching to the full assessment is free and the full report is then priced like any other full assessment.

You can run an assessment and see a free preview of your results before you decide to pay. Payment unlocks the full report for that one assessment: the on-screen analysis and the PDF. It does not buy a subscription, a seat, or access to any other assessment.

Payments are processed by our payment processor on its own hosted checkout page. Your card details go to the payment processor and never pass through or get stored by NISTnow. We record only what we need to know that a purchase happened: the amount, the currency, the status, the timestamps, and the payment processor’s reference identifiers. The payment processor’s own terms apply to the payment itself.

We may change prices at any time. A change never affects a report you have already unlocked.

The free preview lets you see your results before you decide to unlock a report, so you know what you are buying before you pay.

Refunds are handled through a request process. If you believe a purchase deserves a refund, reach out through the contact page and tell us what went wrong. Requests are reviewed individually. If a refund is granted, it is processed through our payment processor, and access to the unlocked report ends as described below.

Here is how that works in practice. Refunds are issued through the payment processor against the original payment. When a payment is refunded in full, access to that report is revoked automatically and the report locks again. A partial refund does not revoke access. A refund or dispute affects only the purchase it concerns: if an upgrade is refunded, the full report locks again and the NISTquick report stays available; if the NISTquick payment behind an upgrade is refunded, both reports lock again. If you open a dispute or chargeback with your bank, access to that report is revoked while the dispute is open. It is restored if the dispute is resolved in our favor and we have not refunded you in the meantime. Any report file you already downloaded stays on your device, and the terms in the intellectual property section still apply to it.

When you use NISTnow, you agree not to:

• use it for anything unlawful, or to help anyone else do so;
• use it on behalf of a business you are not authorized to represent, or enter answers you know to be false in order to produce a misleading report;
• present a report as an audit, a certification, an independent verification, or evidence of compliance, to a customer, an insurer, a regulator, or anyone else;
• share, sell, or sublicense your account, your access to a report, or the report content as a product or service of your own;
• try to break, probe, overload, or work around the security of the service, or access another organization’s data;
• scrape, crawl, or bulk-extract the site’s content, or use automated means to create accounts or run assessments;
• copy the framework content, question wording, guidance, or remediation text to build a competing product;
• remove, obscure, or alter the watermark or any notice on a report.

If you find a security problem in NISTnow, please report it responsibly rather than exploiting it. Send it to security@nistnow.com.

Your answers are yours. The information you enter, including your assessment answers, notes, and the details about your business, belongs to you. You give us permission to use it for the one purpose of running the service for you: producing your analysis, your report, and your data export. We do not sell it and we do not use it to advertise to you.

The report is licensed to you. When you unlock a report, you get a non-exclusive, non-transferable license to use it inside your business and to share it with your own advisors, insurers, or customers as your business needs. You may not resell it, publish it, or distribute it as a product. Every page of an unlocked report carries your organization’s name and the word “Confidential”, and every page of a free preview is watermarked with the email address of the person who downloaded it and the time it was generated. Those markings are part of the document and must stay intact.

The site is ours. NISTnow’s software, design, question wording, guidance, remediation content, and the NISTnow name and logo belong to the owner and are protected by copyright and other rights. These terms give you no rights in them beyond using the service as intended. The NIST Cybersecurity Framework itself is published by NIST and is not ours.

If you send us feedback or a suggestion, we may use it to improve NISTnow without owing you anything for it.

Assessments belong to an organization, not to a single person. When you create an organization you become its owner. As owner, you can invite other people to it and give each of them a role, and you can remove them later.

Everyone you invite into an organization can see that organization’s assessments, including the answers, the notes, and the reports. What each role can do differs: owners manage the organization and its members, members can answer and submit assessments, and viewers can read but not change anything. A portfolio operator is appointed at a parent organization and reaches every organization beneath it: they can read and answer those organizations’ assessments and download their reports, and they also get a consolidated view of scores across the portfolio. They cannot see those organizations’ member lists. Invite people accordingly, and only invite people who should see that information.

If you invite someone, you confirm you have the right to share that organization’s information with them and to give us their email address so we can send the invitation. You are responsible for keeping your organization’s member list current. Removing someone ends their access going forward, but does not recall anything they already downloaded.

You can stop using NISTnow at any time, and you can delete your account from your account settings. Deletion is deliberate: you confirm it by typing the word DELETE. As soon as you confirm, your account is disabled and every one of your sessions is signed out, so nobody can use the account while the deletion is being carried out. Your data is then permanently deleted within 7 days. We describe exactly what is deleted, and the narrow set of records that is kept without your identity attached, in the Privacy Policy.

One limit is worth knowing before you start. If you own an organization that still has other members in it, we cannot delete your account at all until that is resolved, because those members’ assessments live inside that organization. Hand ownership over, or remove the other members, before you request deletion. If you request it first, your account is closed and signed out straight away, and you will need to reach us through the contact page to sort it out.

Deleting your account does not entitle you to a refund of a report you already unlocked, and it removes your access to your reports. Download anything you want to keep first, or use the data export described in the Privacy Policy.

We may suspend or end your access if you breach these terms, if we are required to by law, or if we stop offering the service. If we stop offering the service, we will give you reasonable notice at the email address on your account so you can export your data.

NISTnow is provided on an “as is” and “as available” basis. To the fullest extent the law allows, we disclaim all warranties, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

We do not warrant that the service will be uninterrupted, timely, error-free, or secure, that any defect will be corrected, or that the report, the guidance, or the suggested next steps are accurate, complete, current, or suitable for your business. Any tool or service provider mentioned in a report is a suggestion for you to evaluate yourself, not a recommendation we stand behind, and we have no relationship with them unless we say so.

Decisions about your cybersecurity are yours. Nothing in the service creates a professional, advisory, or fiduciary relationship between you and us.

To the fullest extent the law allows, we will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, data, or anticipated savings, however caused and on any theory of liability, even if we have been advised that such loss was possible.

To the fullest extent the law allows, our total liability to you for all claims arising out of or relating to NISTnow, taken together, will not exceed the total amount you actually paid us in the 12 months before the event giving rise to the claim. If you have paid us nothing, our total liability will not exceed one hundred U.S. dollars ($100).

Nothing in these terms excludes or limits liability that cannot be excluded or limited under applicable law. Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages, so parts of the two sections above may not apply to you.

You agree to indemnify and hold us harmless from any claim, loss, or expense, including reasonable legal fees, arising from your use of NISTnow, your breach of these terms, or your presentation of a report to a third party.

You will tell us promptly about any claim covered by that promise, and we may take over its defense if we choose to. This does not apply to a claim that arises from our own deliberate wrongdoing.

We may update these terms as NISTnow changes or as the law requires. When we do, we update the “Last updated” date at the top of this page. If a change materially affects your rights, we will give you notice at the email address on your account before it takes effect. Continuing to use NISTnow after a change takes effect means you accept the updated terms. If you do not accept them, stop using the service and delete your account.

These terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules, and by the federal law of the United States where it applies. You and we agree that any dispute arising out of or relating to these terms or to NISTnow will be brought exclusively in the state or federal courts located in Texas, and each of us consents to the jurisdiction of those courts.

Neither of us is responsible for a failure or delay caused by something outside our reasonable control, such as an outage at a hosting or payment provider, a network failure, a natural disaster, or a change in the law.

These terms, together with the Privacy Policy, are the entire agreement between you and us about NISTnow. If any part of them is found unenforceable, the rest stays in effect. If we do not enforce a provision, that is not a waiver of it. You may not transfer your rights under these terms without our written consent. We may transfer ours in connection with a transfer of the service, and we will tell you if we do.

The sections on what the assessment and report are, acceptable use, who owns what, disclaimers, and limitation of liability survive the end of your account or of these terms. These terms are between you and us only. Nobody else, including anyone you show a report to, gets rights under them.

Questions about these terms, and any notice you need to send us, should go through the contact page, or by email to info@nistnow.com. We will reply to the email address you write from.